Abstract：
iPhone operating system (iOS) devices utilize binary cookies as a data storage tool, encoding user-specific information within an often-neglected element of smartphone analysis. This binary format contains details such as cookie flags, expiration, and creation dates, domain, and value of the cookie. These data are invaluable for forensic investigations. This study presents a comprehensive methodology to decode and extract valuable data from these files, enhancing the ability to recover user activity information from iOS devices. This paper provides an in-depth forensic investigation into the structure and function of iOS binary cookie files. Our proposed forensic technique includes a combination of reverse engineering and custom-built Python scripts to decode the binary structure. The results of our research demonstrate that these cookie files can reveal an array of important digital traces, including user preferences, visited websites, and timestamps of online activities. It concludes that the forensic analysis of iOS binary cookie files can be a tool for forensic investigators and cybersecurity professionals. In the rapidly evolving domain of digital forensics, this research contributes to our understanding of less-explored data sources within iOS devices and their potential value in investigative contexts.
摘要：
iPhone操作系统（iOS）设备使用二进制cookie作为数据存储工具，在智能手机分析中经常被忽视的元素中编码用户特定的信息。此二进制格式包含Cookie标志、到期,和创建日期，域,和cookie的值。这些数据对于法医调查是无价的。这项研究提出了一种全面的方法，可以从这些文件中解码和提取有价值的数据，增强从iOS设备恢复用户活动信息的能力。本文对iOS二进制cookie文件的结构和功能进行了深入的取证研究。我们提出的取证技术包括逆向工程和定制Python脚本的组合，以解码二进制结构。我们的研究结果表明，这些cookie文件可以揭示一系列重要的数字痕迹，包括用户首选项，访问过的网站，和在线活动的时间戳。它的结论是，iOS二进制cookie文件的取证分析可以成为取证调查人员和网络安全专业人员的工具。在快速发展的数字取证领域，这项研究有助于我们了解iOS设备中探索较少的数据源及其在调查环境中的潜在价值.
